PHP2Shell security graph: 69.3% of sites run PHP, 59% of hosts on PHP 8.1 or older, CVSS 9.2
<aside>
🔗
Read the full PHP2Shell guide on my portfolio: Is Your PHP Patched? The 2-Minute Check · Watch the video walkthrough · Visit my portfolio
</aside>
<aside>
🐘
PHP2Shell explained in 30 seconds: two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) let attackers run code on a server without logging in. Run php -v. You need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or newer in the same branch). Below: how to check, patch and secure a PHP website, with code you can copy. By Xovato Digital Agency.
</aside>
<aside>
🔥
9.2 / 10
CVSS score of each flaw
</aside>
<aside>
🔓
0 logins
needed to attack
</aside>
<aside>
🌍
~70%
of known-language sites run PHP
</aside>
<aside>
🩹
Oct 21, 2026
patched releases shipped
</aside>
🚨 1. PHP2Shell Explained: Why the FBI and Japan Told Sites to Go Offline (CVE-2026-109618)
Date: 21 October 2026. Two critical flaws were found in PHP itself.
Server room
What happened
- Two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed in the PHP core.
- PHP's own advisory says both can lead to remote code execution (RCE): an outsider runs code on your server without logging in. Each is rated 9.2 out of 10 on the CVSS 4.0 scale.
- Servers running Apache with mod_php were considered the most exposed, because PHP runs inside the web server process.
- The flaws were found with the help of AI tools. An OpenAI-led group of researchers and security firms worked with the PHP maintainers for about two months before the fixes shipped.
- PHP runs roughly 70% of websites whose server-side language is known, including WordPress and WooCommerce.
Who reacted
- 🇺🇸 FBI Cyber Division and NSA: patch immediately, and if you cannot, take the system offline until it is fixed. They also asked admins to inventory every PHP install and watch for PHP processes launching unexpected command shells or downloading files.
- 🇯🇵 Japan's Prime Minister Sanae Takaichi: asked companies to check whether their public sites use PHP, prepare to apply the fix the moment it was released, and consider temporarily suspending sites if they could not patch quickly.